[BUG] null-ptr-deref on ksmbd-for-next-next branch

ChenXiaoSong <[email protected]> Wed, 22 Jul 2026 08:47:23 +0800
Newsgroups org.kernel.vger.linux-cifs
Message-ID <[email protected]>
Hi Namjae,

While testing ksmbd-for-next-next branch with a Windows client, I hit 
the following kernel panic:

[  118.738007] BUG: kernel NULL pointer dereference, address: 
0000000000000000
...
[  118.751396] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
...
[  118.775059] Call Trace:
[  118.775761]  <TASK>
[  118.776419]  handle_ksmbd_work+0x269/0x550 [ksmbd]
[  118.777795]  process_scheduled_works+0x206/0x450
[  118.779164]  worker_thread+0x20a/0x2f0
[  118.780253]  ? _raw_spin_unlock_irqrestore+0x12/0x40
[  118.781652]  ? __kthread_parkme+0x49/0xb0
[  118.782885]  kthread+0x104/0x130
[  118.783880]  ? __pfx_worker_thread+0x10/0x10
[  118.785204]  ? __pfx_kthread+0x10/0x10
[  118.786540]  ret_from_fork+0xb0/0x220
[  118.787858]  ? __pfx_kthread+0x10/0x10
[  118.789260]  ret_from_fork_asm+0x1a/0x30
[  118.790721]  </TASK>
[  118.791593] Modules linked in: ksmbd smb_compress smbdirect rdma_cm 
ib_cm iw_cm ib_core libarc4 nls_ucs2_utils
[  118.794721] CR2: 0000000000000000
[  118.795529] ---[ end trace 0000000000000000 ]---


After debugging, I found that patch ("ksmbd: enforce signing required by 
the session") introduced the issue:
https://git.samba.org/?p=ksmbd.git;a=commitdiff;h=7e5a34a4c91621c5315a725531c8d00336b09227;hp=5b1cf1316f83dd2e4c8908addc69877d444bd77b

It also needs the following additional changes:

```
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -140,7 +140,8 @@ static int __process_request(struct ksmbd_work 
*work, struct ksmbd_conn *conn,
                 return SERVER_HANDLER_ABORT;
         }

-       signed_req = conn->ops->is_sign_req(work, command);
+       signed_req = work->sess &&
+                    conn->ops->is_sign_req(work, command);
         if (work->sess && work->sess->sign && !work->encrypted &&
             !signed_req) {
                 conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED);
```

If you want, you can add:

Tested-by: ChenXiaoSong <[email protected]>
Reviewed-by: ChenXiaoSong <[email protected]>

-- 
ChenXiaoSong <[email protected]>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en